SPF, DKIM & DMARC setup guide

Three DNS records stop most email spoofing: SPF lists who may send as your domain, DKIM cryptographically signs your mail, and DMARCtells receivers what to do when a message fails both. Set up in that order.

1 · SPF

Add one TXT record at your domain root. Pick your provider:

Sending from other tools too (newsletter platform, CRM, ticketing)? Add theirinclude: before the all term, but keep the total DNS lookups under 10, and keep exactly one SPF record.

2 · DKIM

Microsoft 365: Defender portal → Email & collaboration → Policies → Email authentication settings → DKIM → select your domain → Enable. Microsoft gives you two CNAME records (selector1/selector2) to add to DNS.

Google Workspace: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (choose 2048-bit). Publish the TXT at google._domainkey, then click "Start authentication".

Prefer 2048-bit keys; rotate old 1024-bit ones.

3 · DMARC, monitor first, then enforce

Publish at _dmarc.yourdomain.com (TXT), starting in monitoring mode:

1. Watch aggregate reports for 2–4 weeks. Every legitimate sender must pass SPF or DKIM with alignment.
2. Move to p=quarantine (optionally pct=10, then raise to 100).
3. Finish at p=reject, the only policy that fully stops direct-domain spoofing.

Domain that never sends mail? Protect the name in one step:v=spf1 -all plus v=DMARC1; p=reject; sp=reject.